Ghost Credentials: Dormant Identities Pose New Cloud Security Risk
Security researcher Aleksandr Krasnov has identified a new cloud attack vector: dormant non-human identities, or 'ghost credentials,' creating security blind spots and hidden trust paths exploitable by attackers.
A recent insider incident involving an idle AI-enabled workflow agent that unexpectedly reactivated and began making suspicious API calls has brought to light a significant and growing cloud security threat: dormant non-human identities, or "ghost credentials." Security architect Aleksandr Krasnov's investigation into this anomaly revealed a complex web of these identities—including tokens, agents, and service accounts—operating outside traditional trust boundaries. These entities, despite their inactivity, retained the ability to move laterally across cloud environments and escalate privileges, exposing a critical blind spot in how organizations manage trust in increasingly automated systems.
Krasnov's findings indicate that organizations have lost visibility and control over the vast number of non-human identities that populate their cloud infrastructure. These identities, often created for specific tasks and then forgotten, can accumulate extensive permissions over time. When compromised or reactivated maliciously, they can serve as an easy entry point for attackers, bypassing the more robust defenses typically applied to human user accounts. The ease with which these credentials can be exploited is alarming; Krasnov notes that attackers can choose between the time-consuming process of crafting phishing campaigns or the significantly faster method of hunting for exposed tokens and dormant accounts.
During his research, Krasnov observed how a single leaked key or a chain of abused trust relationships could lead to a full cloud compromise, potentially even pivoting to critical identity providers like Okta. This highlights the inherent risk in implicit or inferred trust relationships that organizations may not have explicitly defined or monitored. The investigation into the workflow agent demonstrated that dormant credentials, when reactivated, could escalate to gain root or administrator status, effectively granting attackers the highest level of access.
To combat this emerging threat, Krasnov has developed NHI Hound, an open-source tool designed to detect these ghost credentials and map potential risks within cloud environments. The tool ingests identity data from various sources, including identity providers like Okta, code repositories like GitHub, and cloud IAM platforms. By analyzing this data, NHI Hound exposes hidden trust links between human and non-human accounts, simulating worst-case abuse scenarios to help defenders identify which dormant credentials could lead to critical systems or administrative roles.
NHI Hound also aims to provide a comprehensive inventory of an organization's non-human and human identities, classifying them by their trust-severity levels. It offers remediation suggestions, flagging "critical" conditions where low-trust identities can perform actions equivalent to super-admin accounts due to undefined trust relationships. While informal testing with small to mid-size companies has shown promising results, Krasnov acknowledges that larger enterprises face a more severe challenge due to the sheer volume of identities, which can make the identity trust graph "super, super messy."
Krasnov plans to present a red-team methodology for achieving full cloud compromise using ghost credentials at Black Hat USA 2026. He will also discuss blue-team strategies for rebuilding a "source of truth" for non-human trust. The NHI Hound tool, once more widely adopted, could significantly aid organizations in cleaning up their non-human identity trust graphs, a process Krasnov estimates could take 6 to 9 months for smaller organizations. For larger enterprises, he envisions future enhancements to NHI Hound, including improved visualization and more user-friendly output, to better manage the complexity of extensive identity graphs.
The proliferation of AI agents and automated workflows, while boosting efficiency, has inadvertently created fertile ground for ghost credentials. These non-human identities are essential for automation but require diligent management to prevent them from becoming significant security liabilities. As organizations increasingly rely on these automated systems, understanding and mitigating the risks associated with dormant or forgotten credentials will become paramount to maintaining robust cloud security.